Russia has spent two years building the infrastructure of a captive messaging market: a law mandating Max come pre-installed on every device sold in the country, a deliberate throttling campaign against Telegram, and — as of August 1, 2026 — free data for Max from all four major carriers. On August 11, Meduza reported that Max's own AI assistant, Alisa, has been telling users the app lacks end-to-end encryption and that they should install Telegram, Signal, or WhatsApp instead. Independent outlet Verstka first spotted the pattern in chat logs. Alisa reportedly went further, suggesting users keep Max on a separate "maxphone" isolated from anything containing banking credentials or private information, since the app's metadata — IP addresses, contacts, device data, provider information — "may be shared with third parties, including government agencies."
The irony is almost too clean, but it is not an isolated glitch. It lands three weeks after the European Union sanctioned VK, Max's parent company, and its subsidiary Communication Platform LLC on July 13, 2026, for developing an app the EU says was built "under the supervision" of Russia's Federal Security Service. Brussels also sanctioned three SORM equipment makers — VAS Experts, Norsi-Trans, and Tsitadel — plus eleven individuals, concluding that VK "provides technical support for the repression of civil society and democratic opposition." A state-run AI assistant telling users not to trust the app is not a contradiction of that finding. It is corroboration from inside the product.
The Steelman: Digital Sovereignty Has a Real Argument
Before dismissing Moscow's project as pure repression, it's worth taking the sovereignty case on its own terms. Every state has a legitimate interest in not routing its citizens' daily communications through infrastructure it cannot compel to comply with lawful process, cooperate on criminal investigations, or preserve evidence. The EU itself has pushed foreign platforms toward local data residency and interoperability rules under the DMA and DSA. India's data localization requirements and China's Cybersecurity Law rest on a similar premise: critical communications infrastructure shouldn't sit entirely outside a government's jurisdiction. Zero-rating Max's data isn't inherently sinister — plenty of democracies have debated subsidized access to essential digital services. If Russia's goal were merely a sovereign, auditable domestic alternative to foreign platforms, that would be a defensible, if paternalistic, policy choice.
Why Coercion, Not Just Sovereignty, Is the Actual Design
But the record built since 2025 shows Max was never positioned to compete on its merits. It was engineered to win by default: mandatory pre-installation from September 1, 2025, a throttling campaign against Telegram that Roskomnadzor initially denied and then acknowledged, and now zero-rated data that removes even the cost incentive to use anything else. Beeline's CEO described the arrangement as treating Max as "part of the state's digital infrastructure" — language that concedes the app isn't competing in a market so much as being installed as a utility. Real sovereignty arguments don't need to throttle the competition or force preinstallation under threat of antitrust action against Apple, which Russia's FAS opened on August 3 after Apple pulled Max from the App Store in June.
The deeper problem is that Max's own security architecture appears to validate the EU's sanctions rationale rather than rebut it. Independent researchers have previously documented that Max can have TLS session validation disabled by server command — a mechanism that would let a network-level actor, including a government filtering system, intercept messages, files, and passwords. An AI assistant candidly warning users about a lack of end-to-end encryption isn't an outlier bug; it's a feature of a product whose developer was supervised, per the EU's own designation, by the FSB. When the app's own chatbot recommends adversary tools like Signal — built specifically to resist the kind of interception Max reportedly permits — the sovereignty argument collapses into what it always was underneath: a surveillance mandate wearing sovereignty's clothing.
The Proportionality Failure
This is where the pro-innovation case for restraint applies most directly. Legitimate data-sovereignty policy is narrowly tailored: it targets specific risks (foreign court orders, extraterritorial data seizure) with proportionate tools (localization requirements, audit rights). What Russia has built instead is untargeted and coercive — mandatory installation, engineered competitor throttling, and now subsidized bandwidth, layered onto a product multiple independent technical reviews say cannot guarantee message confidentiality even from its own operator. That combination doesn't protect Russian users' communications from foreign interference; it centralizes interception capability in the hands of the one actor with the least external accountability.
The practical result may be self-defeating in exactly the way Alisa's leak suggests. Coerced scale — tens of millions of users who did not choose Max on its merits — is brittle if the product cannot earn trust even from its own AI. Governments serious about domestic digital sovereignty should look to models that compete on security and interoperability, not ones that require throttling rivals and then quietly telling users to use them anyway.